MOHAMMAD SHAKER
CLOUD / PLATFORM ENGINEERING

HelixWorks: Build an AI Application Platform on AWS

From customer intent to isolated EKS production with GitOps and ambient mesh

CURRICULUM

Build the public HelixWorks monorepo through one 35-day product journey: specifications, generation, previews, managed data, identity, releases, GitOps, Istio ambient service identity and policy, reversible operations, and an evidence-gated AWS production decision.

  1. 01Meet HelixWorks: A Platform, Not One AI AppBuild one bounded platform that can create, host, govern, and retire several kinds of AI application.Published 11 Aug 20265 sections
  2. 02From Laptop Hardware to a Local Kind PlatformTurn one laptop into a disposable Kubernetes analogue and prove both healthy scheduling and bounded recovery.Published 11 Aug 20265 sections
  3. 03Draw the Three Planes and Split the MicroservicesBuild and break one support application locally so service boundaries become observable facts, not boxes in a diagram.Published 11 Aug 202612 sections
  4. 04Create an Organization, Project, and Application SpecificationTurn a customer idea into a tenant-scoped, versioned contract without creating a runtime prematurely.Published 11 Aug 20265 sections
  5. 05Generate an Application Through an Auditable JobConvert one immutable specification into one reproducible artifact while making retries, model calls, and policy decisions observable.Published 11 Aug 20265 sections
  6. 06Preview Safely in an Isolated RuntimeLet a reviewer interact with generated code without granting it production data, identity, network, or permanence.Published 11 Aug 20265 sections
  7. 07Give Generated Apps Managed Data Without Losing OwnershipProvision durable application data through a platform contract while keeping each generated app responsible for its own tenants and authorization predicates.Published 11 Aug 20265 sections
  8. 08Connect Enterprise Systems with Workload AuthorityEstablish an administrator-approved machine grant before any optional user-delegated connector access.Published 11 Aug 20265 sections
  9. 09Add Delegated User Access and Private ConnectivityLet a user approve one source action while the broker reaches the source through a route that is not public.Published 11 Aug 202610 sections
  10. 10Authenticate Humans and Map Identity Across Three PlanesAuthenticate a person once where appropriate, but authorize and revoke that person independently in the provider, hosted-runtime, and generated-application planes.Published 11 Aug 20265 sections
  11. 11Share and Revoke Without Leaking AuthorityLet a customer share one generated application without confusing platform membership, runtime identity, and application access.Published 11 Aug 20266 sections
  12. 12Publish an Immutable ReleaseTurn an approved preview into a traceable release without rebuilding or silently changing the artifact.Published 11 Aug 20266 sections
  13. 13Change, Redeploy, and Roll Back SafelyMake product change routine by promoting immutable revisions and recovering through the owner of each desired state.Published 11 Aug 20266 sections
  14. 14Operate and Support with Observable EvidenceDiagnose from customer symptom to substrate while treating every green signal as evidence for only its own boundary.Published 11 Aug 20266 sections
  15. 15Export, Retire, and Delete CompletelyEnd the customer lifecycle with a verifiable export and an ordered deletion across every owning plane.Published 11 Aug 20266 sections
  16. 16DRY, SRP, IoC, DI, and Service ContractsKeep HelixWorks changeable by assigning one reason to change per service and injecting implementations behind explicit contracts.Published 11 Aug 20266 sections
  17. 17Package Kubernetes Workloads with KustomizeReuse one workload design while keeping dev, staging, and production differences small, explicit, and reviewable.Published 11 Aug 20266 sections
  18. 18Separate Infrastructure State from Workload StateDiagnose and reconcile four desired-state owners instead of trusting one magical “declarative” status.Published 11 Aug 20267 sections
  19. 19Terraform Plan, State, Modules, and Physical EffectsFollow Terraform from reviewed configuration through state and AWS APIs to real compute, memory, storage, and network effects.Published 11 Aug 20267 sections
  20. 20Isolate AWS Accounts, IAM, State, and GuardrailsGive dev, staging, and production separate AWS accounts and EKS clusters while promoting the same immutable HelixWorks artifact.Published 11 Aug 20267 sections
  21. 21Repeatable VPCs and Private ConnectivityBuild the same isolated network contract in three AWS accounts before any Kubernetes workload exists.Published 11 Aug 20267 sections
  22. 22Development EKS as the Fast Feedback EnvironmentCreate the first managed Kubernetes cluster without confusing an Active control plane with a usable product.Published 11 Aug 20267 sections
  23. 23Staging EKS as the Production RehearsalProve a production-shaped release in an isolated account without sharing production authority or data.Published 11 Aug 20267 sections
  24. 24Production EKS and the Protected Runtime BoundaryBuild the production cluster as a separately governed service boundary, not a larger copy of dev.Published 11 Aug 20267 sections
  25. 25Bootstrap Argo CD Without Creating a Circular OwnerInstall the GitOps controller once, then let it own workload declarations without asking it to create its own cluster.Published 11 Aug 20267 sections
  26. 26Immutable Promotion with ApplicationSetPromote one proven artifact through isolated clusters by changing only reviewed digest references.Published 11 Aug 20267 sections
  27. 27Secrets, Network, Admission, and Supply-Chain GuardrailsMake unsafe workloads fail closed before they can reach customer data or production compute.Published 11 Aug 20267 sections
  28. 28Design Event Scaling, Prove the Current Launch VetoDistinguish a future scaling design from capabilities that the repository actually implements today.Published 11 Aug 20267 sections
  29. 29Observe, Back Up, Restore, and ReconstructRecover customer outcomes by rebuilding each state owner in dependency order, not by trusting one green dashboard.Published 11 Aug 20267 sections
  30. 30Service Traffic Baseline: Why Add a Mesh?Freeze the working Kubernetes traffic contract before changing how traffic is secured.Published 11 Aug 20269 sections
  31. 31Install and Enroll Istio Ambient SafelyInstall pinned cluster components first, then enroll only the HelixWorks namespace through Git.Published 11 Aug 20269 sections
  32. 32Authorize Service-to-Service Traffic at Layer 4Use authenticated Kubernetes ServiceAccount identities to restrict which HelixWorks workloads may open connections.Published 11 Aug 20268 sections
  33. 33Enforce HTTP Intent at a Destination WaypointAdd method-and-path authorization at the destination waypoint while refusing to claim an HTTPRoute that the repository does not declare.Published 11 Aug 20268 sections
  34. 34Observe, Migrate, Recover, and Map Ambient Mesh to EKSTreat mesh adoption as a reversible product migration whose evidence climbs from node proxies to customer requests.Published 11 Aug 20269 sections
  35. 35Production Launch Gate for AWS and Ambient MeshKeep production traffic closed until product, security, delivery, capacity, and recovery evidence agree.Published 11 Aug 20268 sections